FTC Settlement Bars Kochava From Selling Sensitive Location Data

The U.S. Federal Trade Commission reached a proposed settlement with data broker Kochava and its subsidiary Collective Data Solutions that would prohibit them from selling, sharing, or disclosing sensitive location data without consumers’ affirmative express consent. The FTC said Kochava sold precise geolocation data tied to hundreds of millions of mobile devices, along with related information such as mobile device IDs, app usage data, and demographic details, in ways that could expose visits to sensitive locations including health care facilities and places of worship.

The proposed order, approved by the FTC in a 2-0 vote and filed in federal court in Idaho, requires Kochava to limit sensitive location data use to consumer-requested services, verify suppliers’ consent practices, notify the FTC about certain improper third-party disclosures, tell consumers who purchased their precise location data, allow consent to be withdrawn, and follow a retention and deletion schedule. The case stems from an FTC lawsuit first filed in 2022, and while the settlement does not impose a fine, it formalizes restrictions that overlap with commitments Kochava had already made in a separate class-action settlement to stop monetizing sensitive location data collected through app SDKs.